From 49969faa9189022ce67572f83b1ec9d13c8bd93c Mon Sep 17 00:00:00 2001
From: Andrew Osmond <aosmond@mozilla.com>
Date: Wed, 28 Mar 2018 14:47:32 -0400
Subject: Bug 1409440. r=tnikkel, a=RyanVM

---
 image/Downscaler.cpp      | 14 ++++++++++----
 image/DownscalingFilter.h | 14 ++++++++++----
 2 files changed, 20 insertions(+), 8 deletions(-)

(limited to 'image')

diff --git a/image/Downscaler.cpp b/image/Downscaler.cpp
index 18f09c596..2ded487a5 100644
--- a/image/Downscaler.cpp
+++ b/image/Downscaler.cpp
@@ -231,6 +231,7 @@ Downscaler::CommitRow()
     int32_t inLineToRead = filterOffset + mLinesInBuffer;
     MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
     if (mCurrentInLine == inLineToRead) {
+      MOZ_RELEASE_ASSERT(mLinesInBuffer < mWindowCapacity, "Need more rows than capacity!");
       skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
                                  mWindow[mLinesInBuffer++], mHasAlpha,
                                  supports_sse2() || supports_mmi());
@@ -239,7 +240,7 @@ Downscaler::CommitRow()
     MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
                "Writing past end of output");
 
-    while (mLinesInBuffer == filterLength) {
+    while (mLinesInBuffer >= filterLength) {
       DownscaleInputLine();
 
       if (mCurrentOutLine == mTargetSize.height) {
@@ -340,9 +341,14 @@ Downscaler::DownscaleInputLine()
 
   // Shift the buffer. We're just moving pointers here, so this is cheap.
   mLinesInBuffer -= diff;
-  mLinesInBuffer = max(mLinesInBuffer, 0);
-  for (int32_t i = 0; i < mLinesInBuffer; ++i) {
-    swap(mWindow[i], mWindow[filterLength - mLinesInBuffer + i]);
+  mLinesInBuffer = min(max(mLinesInBuffer, 0), mWindowCapacity);
+
+  // If we already have enough rows to satisfy the filter, there is no need
+  // to swap as we won't be writing more before the next convolution.
+  if (filterLength > mLinesInBuffer) {
+    for (int32_t i = 0; i < mLinesInBuffer; ++i) {
+      swap(mWindow[i], mWindow[filterLength - mLinesInBuffer + i]);
+    }
   }
 }
 
diff --git a/image/DownscalingFilter.h b/image/DownscalingFilter.h
index 6b0d3b26b..1485b85c2 100644
--- a/image/DownscalingFilter.h
+++ b/image/DownscalingFilter.h
@@ -246,6 +246,7 @@ protected:
     int32_t inputRowToRead = filterOffset + mRowsInWindow;
     MOZ_ASSERT(mInputRow <= inputRowToRead, "Reading past end of input");
     if (mInputRow == inputRowToRead) {
+      MOZ_RELEASE_ASSERT(mRowsInWindow < mWindowCapacity, "Need more rows than capacity!");
       skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
                                  mWindow[mRowsInWindow++], mHasAlpha,
                                  supports_sse2() || supports_mmi());
@@ -254,7 +255,7 @@ protected:
     MOZ_ASSERT(mOutputRow < mNext.InputSize().height,
                "Writing past end of output");
 
-    while (mRowsInWindow == filterLength) {
+    while (mRowsInWindow >= filterLength) {
       DownscaleInputRow();
 
       if (mOutputRow == mNext.InputSize().height) {
@@ -330,9 +331,14 @@ private:
 
     // Shift the buffer. We're just moving pointers here, so this is cheap.
     mRowsInWindow -= diff;
-    mRowsInWindow = std::max(mRowsInWindow, 0);
-    for (int32_t i = 0; i < mRowsInWindow; ++i) {
-      std::swap(mWindow[i], mWindow[filterLength - mRowsInWindow + i]);
+    mRowsInWindow = std::min(std::max(mRowsInWindow, 0), mWindowCapacity);
+
+    // If we already have enough rows to satisfy the filter, there is no need
+    // to swap as we won't be writing more before the next convolution.
+    if (filterLength > mRowsInWindow) {
+      for (int32_t i = 0; i < mRowsInWindow; ++i) {
+        std::swap(mWindow[i], mWindow[filterLength - mRowsInWindow + i]);
+      }
     }
   }
 
-- 
cgit v1.2.3